Privacy notice

How we handle personal data on this website, under Articles 13 and 14 GDPR and the UK GDPR.

Last updated: 2 September 2026

Who is responsible

Controller

Nemtio Limited, 71–75 Shelton Street, London WC2H 9JQ, United Kingdom

Company number

16889481 — Companies House, England and Wales

Director

Patrick Hohenecker

Contact

Use Get in touch on the main page

We have not appointed a data protection officer; we are not required to. Questions about this notice reach the director directly.

What we process, and why

Your conversation with the agent

The questions you type are sent to an AI provider so an answer can be generated, and are processed to answer you and to improve which questions the agent handles well.

• Data: the text you type, the language you selected, and a technical session identifier.
• Lawful basis: Art. 6(1)(b) GDPR where you are asking about a possible contract, and Art. 6(1)(f) — our legitimate interest in running and improving an information service.
• AI provider: Anthropic PBC, San Francisco, California, United States (Claude API) — our processor under Art. 28 GDPR, on the basis of Anthropic's Data Processing Addendum.
• Training: your input is not used to train Anthropic's models. This is excluded by their commercial terms.
• Retention: we store each question and the agent's answer for 90 days, in a database hosted in the European Union, and then they are deleted automatically. We keep them to see which questions the agent answers well and which it does not. Anthropic retains inputs separately for up to 30 days for trust-and-safety purposes.
• How your turns are grouped: a random identifier is generated when you first ask something, so the questions in one conversation can be read together. It exists only in your browser's memory — nothing is written to your device, no cookie and no local storage, which is why this site asks you to accept nothing. Reloading the page starts a new one, and it cannot be linked to you or to a later visit.

The contact form

• Data: your email address, and optionally your organisation type and weekday trip volume.
• Purpose: to reply to you and arrange a planning pass or a call.
• Lawful basis: Art. 6(1)(b) GDPR — steps prior to a contract at your request.
• Retention: 24 months after our last contact, unless a business relationship begins.

Server logs

• Data: IP address, timestamp, requested page, browser and operating system.
• Purpose: delivering the site, security, and diagnosing faults.
• Lawful basis: Art. 6(1)(f) GDPR.
• Retention: 30 days — the default retention of our hosting provider's logging service.

Storage on your device

This site stores only what it needs to work, so there is no cookie banner — there is nothing optional to consent to.

• Session identifier — keeps your conversation together while you use the site. Expires when your session ends.
• Language and theme — stored in your browser's local storage only after you actively choose one, so your choice survives a reload. Nothing is written before you choose.

There is no analytics, no advertising, no tracking, and no profiling.

Everything this site needs — its fonts, its interface icons and the code it runs on — is served from our own servers. No third party is contacted when you load a page, and no content delivery network receives your IP address.

Who else receives data

• Hosting: Google Cloud EMEA Limited (Google Cloud Platform), region europe-west1 in Belgium — as our processor, under Google's Cloud Data Processing Addendum.
• AI provider: Anthropic PBC, San Francisco, United States — as our processor, as described above.

We do not sell personal data and do not share it for any other purpose.

Where data is stored, and transfers

Your data is stored in the European Union — Google Cloud region europe-west1 in Belgium. Google's own support and sub-processing functions may access data from outside the EEA; those transfers are covered by the Standard Contractual Clauses in Google's Cloud Data Processing Addendum.

Nemtio Limited is established in the United Kingdom, so our staff accessing that data constitutes a transfer from the EEA to the UK. This relies on the European Commission's adequacy decision for the United Kingdom.

Anthropic PBC processes conversation text in the United States. That transfer relies on the Standard Contractual Clauses in Anthropic's Data Processing Addendum. A copy of the safeguards is available on request.

Your rights

You have the right to access your data (Art. 15), correct it (Art. 16), have it erased (Art. 17), restrict processing (Art. 18), receive it in portable form (Art. 20), and object to processing based on legitimate interest (Art. 21). Where you gave consent, you may withdraw it at any time.

You may also complain to a supervisory authority — in the UK the Information Commissioner's Office, or in the EU the authority in your country of residence.

Changes

We will update this notice when the site or its processing changes, and the date above will change with it.

Deutsche Fassung: Datenschutzerklärung